@namzu/sandbox 26.0.0 → 28.0.0

package/dist/backends/kubernetes/per-sandbox-fence.js

@@ -0,0 +1,522 @@
+/**
+ * What the per-sandbox egress fence is checked FOR, and the operator-pinned
+ * host set that tightens it.
+ *
+ * `per-sandbox-policy.ts` used to prove the fence by GETting the
+ * `ValidatingAdmissionPolicy` and its binding and stopping at "the request
+ * succeeded". An object that exists is not an object that fences: a binding
+ * whose `validationActions` is `[Audit]` or `[Warn]` logs and admits, a
+ * binding that names another policy attaches nothing to this one, a policy
+ * with `failurePolicy: Ignore` admits whatever its expressions cannot
+ * evaluate, a binding whose namespace selector excludes the sandboxes'
+ * namespace never runs there, and a policy whose `matchConditions` name a
+ * different user never matches this host. Each reads, from the outside,
+ * exactly like an enforced fence, which is the failure the `no-network`
+ * baseline's check exists to prevent for its own object: that one compares the
+ * named object to the translation field by field, and refuses on any
+ * difference.
+ *
+ * This module is the same standard applied to the fence. It reads what the
+ * cluster stored and compares it, field by field, to what the writer relies
+ * on, and refuses with a named error carrying the field that failed — before
+ * anything is written.
+ *
+ * ## What it can and cannot prove
+ *
+ * It proves the CONFIGURATION of the fence: that the binding attaches this
+ * policy, denies, fails closed, covers the namespace and the verbs, and that
+ * the policy matches the configured identity. It does not evaluate the
+ * policy's CEL: whether the shipped expressions refuse what they claim is
+ * measured against an API server (see the header of
+ * `validatingadmissionpolicy-cilium.yaml`), not derivable from the stored
+ * object. The one exception is the companion policy below, whose expressions
+ * this module owns and compares verbatim.
+ *
+ * ## The operator-pinned host set
+ *
+ * The shipped fence bounds the SHAPE of what a host may write, not the names:
+ * any host holding the write verbs can grant any syntactically valid
+ * `toFQDNs` entry. `config.egress.perSandbox.permittedHostsParam` names a
+ * `ConfigMap` an operator maintains — the reviewed hostnames and ports — and
+ * a COMPANION policy (`validatingadmissionpolicy-cilium-permitted-hosts.yaml`)
+ * refuses, at admission, any `toFQDNs` name or port outside it. The backend
+ * reads the same ConfigMap and refuses locally, with a precise error instead
+ * of an opaque 403, but the admission rule stays the authority: the local
+ * check is a courtesy and a second reader, never the boundary.
+ *
+ * A companion rather than a change to the shipped policy because the shipped
+ * policy is already applied in clusters, and a host that does not configure
+ * the parameter must see byte-for-byte what it saw before. The companion
+ * covers CREATE and UPDATE only: a DELETE never widens, and a missing
+ * parameter must not make `setNetworkPolicy([])` — the revoke — impossible.
+ */
+import { isDeepStrictEqual } from 'node:util';
+import { assertUsableHost, } from './egress-policy.js';
+import { isRecord, matchesLabelSelector, readList } from './ingress-policy.js';
+import { KubernetesAlreadyGoneError, KubernetesCredentialError, } from './k8s-client.js';
+import { configMapPath } from './objects.js';
+/**
+ * Raised when the fence EXISTS but would not enforce what this backend relies
+ * on — `validationActions` without `Deny`, a binding that names another
+ * policy, `failurePolicy: Ignore`, a namespace selector that leaves the
+ * sandboxes' namespace out, a `matchConditions` that names another identity,
+ * a companion policy whose expressions are not the ones this version ships,
+ * or a binding whose parameter is not the configured one.
+ *
+ * Its own class rather than a reuse of
+ * `KubernetesAdmissionFenceMissingError`, because the operator's action
+ * differs: that error says to apply a manifest, this one says an applied
+ * object is wrong and names the field. `field` is the dotted path inside
+ * `resourceKind`, `expected` what the writer needs and `actual` what the
+ * cluster holds.
+ */
+export class KubernetesAdmissionFenceInertError extends Error {
+    resourceKind;
+    objectName;
+    field;
+    expected;
+    actual;
+    name = 'KubernetesAdmissionFenceInertError';
+    constructor(resourceKind, objectName, field, expected, actual) {
+        super(`kubernetes: config.egress.perSandbox is configured but the ${resourceKind} named ${objectName} would not fence what this host writes: ${field} is ${actual}, expected ${expected}. An applied admission object that does not enforce reads exactly like one that does, and the host holds create/patch/delete on every CiliumNetworkPolicy in the namespace, so nothing was written. Correct the object (the shipped k8s/manifests/validatingadmissionpolicy-cilium.yaml and validatingadmissionpolicy-cilium-permitted-hosts.yaml are the references) and call again.`);
+        this.resourceKind = resourceKind;
+        this.objectName = objectName;
+        this.field = field;
+        this.expected = expected;
+        this.actual = actual;
+    }
+}
+/**
+ * Raised when `permittedHostsParam` is configured and the ConfigMap it names
+ * cannot be used: absent, unreadable, or not in the shape the companion
+ * policy reads. Every `setNetworkPolicy` call that grants a host is refused
+ * with it, and nothing is written.
+ */
+export class KubernetesPermittedHostsParamError extends Error {
+    param;
+    name = 'KubernetesPermittedHostsParamError';
+    constructor(param, reason, cause) {
+        super(`kubernetes: config.egress.perSandbox.permittedHostsParam names ConfigMap ${param.namespace}/${param.name}, which ${reason}. The admission policy that pins the permitted hosts reads the same object and denies every grant while it is missing or malformed, so this host refuses first, with nothing written. The expected shape is data.hosts (exact hostnames), data.patterns (*.domain patterns) and data.ports (numbers), each one entry per line; see k8s/manifests/validatingadmissionpolicy-cilium-permitted-hosts.yaml.`, cause === undefined ? undefined : { cause });
+        this.param = param;
+    }
+}
+/**
+ * Raised when a `setNetworkPolicy` call names a host or a port the
+ * operator-pinned set does not contain. Local, named and before any write; the
+ * admission policy would refuse the same body with an opaque 403.
+ *
+ * `hosts` are the `allowedHosts` entries as written; `ports` are the numbers
+ * outside the set, and `unrestrictedPortsFor` the hosts whose rule carries no
+ * port restriction at all — every port is outside any list.
+ */
+export class KubernetesPermittedHostsError extends Error {
+    param;
+    hosts;
+    ports;
+    unrestrictedPortsFor;
+    name = 'KubernetesPermittedHostsError';
+    constructor(param, hosts, ports, unrestrictedPortsFor) {
+        const parts = [];
+        if (hosts.length > 0) {
+            parts.push(`the host(s) ${hosts.map((h) => JSON.stringify(h)).join(', ')} are not in it`);
+        }
+        if (ports.length > 0) {
+            parts.push(`the port(s) ${ports.join(', ')} are not in it`);
+        }
+        if (unrestrictedPortsFor.length > 0) {
+            parts.push(`${unrestrictedPortsFor.map((h) => JSON.stringify(h)).join(', ')} would be granted on EVERY port, because config.egress.perSandbox.narrowing sets no ports for it, and every port is outside any list (set narrowing.ports or narrowing.hostPorts)`);
+        }
+        super(`kubernetes: refusing setNetworkPolicy: ConfigMap ${param.namespace}/${param.name} pins the hosts and ports this host may grant, and ${parts.join('; ')}. The shipped admission policy refuses the same body, so it would be a 403 after the fact. Nothing was written.`);
+        this.param = param;
+        this.hosts = hosts;
+        this.ports = ports;
+        this.unrestrictedPortsFor = unrestrictedPortsFor;
+    }
+}
+// ---------------------------------------------------------------------------
+// Reading an admission object
+// ---------------------------------------------------------------------------
+function describe(value) {
+    if (value === undefined)
+        return 'absent';
+    const text = JSON.stringify(value);
+    return text === undefined ? String(value) : text.length > 200 ? `${text.slice(0, 200)}…` : text;
+}
+/** One expression, whitespace-collapsed — a folded YAML scalar and a one-liner compare equal. */
+function normalizeExpression(value) {
+    return typeof value === 'string' ? value.replace(/\s+/g, ' ').trim() : '';
+}
+const CILIUM_GROUP = 'cilium.io';
+const CILIUM_VERSION = 'v2';
+const CILIUM_RESOURCE = 'ciliumnetworkpolicies';
+/** The verbs of a `CiliumNetworkPolicy` write the shipped main policy covers. */
+export const FENCE_OPERATIONS = ['CREATE', 'UPDATE', 'DELETE'];
+/** The verbs the companion covers: a DELETE never widens, see the module header. */
+export const COMPANION_OPERATIONS = ['CREATE', 'UPDATE'];
+function listOf(value) {
+    const read = readList(value);
+    return read === 'unreadable' ? undefined : (read ?? []);
+}
+/** Does one admission `NamedRuleWithOperations` cover this operation on the CRD? */
+function ruleCovers(rule, operation) {
+    if (!isRecord(rule))
+        return false;
+    const has = (field, wanted) => {
+        const list = listOf(rule[field]);
+        return list !== undefined && (list.includes(wanted) || list.includes('*'));
+    };
+    // A rule naming `resourceNames` narrows to those objects, which cannot
+    // include the ones this host creates under names it generates.
+    const names = listOf(rule.resourceNames);
+    if (names === undefined || names.length > 0)
+        return false;
+    return (has('apiGroups', CILIUM_GROUP) &&
+        has('apiVersions', CILIUM_VERSION) &&
+        has('resources', CILIUM_RESOURCE) &&
+        has('operations', operation));
+}
+/** Does any rule of the list cover the operation? `undefined` when the list is not a list. */
+function rulesCover(rules, operation) {
+    const list = listOf(rules);
+    if (list === undefined)
+        return undefined;
+    return list.some((rule) => ruleCovers(rule, operation));
+}
+/**
+ * `matchConstraints` (policy) / `matchResources` (binding): both are the same
+ * `MatchResources` shape. Proves that, between them, the writes in
+ * `operations` reach the validations — resource rules cover them, no exclude
+ * rule removes them, and neither selector can be satisfied by an object the
+ * host chooses the labels of.
+ */
+function assertMatchResources(kind, objectName, path, match, operations, namespace, 
+/** A policy MUST state its resource rules; a binding may leave them to the policy. */
+rulesRequired) {
+    const fail = (field, expected, actual) => {
+        throw new KubernetesAdmissionFenceInertError(kind, objectName, `${path}.${field}`, expected, describe(actual));
+    };
+    if (match === undefined || match === null) {
+        if (rulesRequired)
+            fail('resourceRules', 'rules covering cilium.io ciliumnetworkpolicies', match);
+        return;
+    }
+    if (!isRecord(match)) {
+        throw new KubernetesAdmissionFenceInertError(kind, objectName, path, 'an object', describe(match));
+    }
+    if (match.resourceRules !== undefined || rulesRequired) {
+        for (const operation of operations) {
+            const covered = rulesCover(match.resourceRules, operation);
+            if (covered !== true) {
+                fail('resourceRules', `a rule covering ${operation} of cilium.io/${CILIUM_VERSION} ${CILIUM_RESOURCE} (a binding that narrows the policy must still reach every write the host issues)`, match.resourceRules);
+            }
+        }
+    }
+    const excluded = match.excludeResourceRules;
+    if (excluded !== undefined) {
+        for (const operation of operations) {
+            if (rulesCover(excluded, operation) !== false) {
+                fail('excludeResourceRules', `no rule excluding ${operation} of ${CILIUM_RESOURCE}`, excluded);
+            }
+        }
+    }
+    // An object selector is matched against the OBJECT's labels, which the
+    // writing host chooses: a fence that applies only to objects carrying a
+    // label the host can simply leave off fences nothing.
+    const objectSelector = match.objectSelector;
+    if (objectSelector !== undefined && objectSelector !== null) {
+        const empty = isRecord(objectSelector) &&
+            Object.keys(isRecord(objectSelector.matchLabels) ? objectSelector.matchLabels : {}).length ===
+                0 &&
+            (listOf(objectSelector.matchExpressions) ?? [null]).length === 0;
+        if (!empty)
+            fail('objectSelector', "absent or empty (the host chooses its objects' labels)", objectSelector);
+    }
+    const namespaceSelector = match.namespaceSelector;
+    if (namespace !== undefined && namespaceSelector !== undefined && namespaceSelector !== null) {
+        // Matched against the one label every namespace is guaranteed to carry.
+        // A selector on any other label is not decidable from the stored
+        // objects, and an unprovable fence is an unproven one.
+        const verdict = matchesLabelSelector(namespaceSelector, {
+            'kubernetes.io/metadata.name': namespace,
+        });
+        if (verdict !== 'yes') {
+            fail('namespaceSelector', `a selector that selects namespace ${namespace} (decided from the automatic kubernetes.io/metadata.name label, the only one this host can rely on; a selector on other labels is refused as unprovable)`, namespaceSelector);
+        }
+    }
+}
+/** The conditions the host identity is checked against, when one is configured. */
+function assertHostIdentity(policyName, policy, hostIdentity) {
+    if (hostIdentity === undefined)
+        return;
+    const expected = `request.userInfo.username == '${hostIdentity}'`;
+    const conditions = listOf(policy.matchConditions);
+    const names = (conditions ?? []).map((c) => isRecord(c) ? normalizeExpression(c.expression) : '');
+    // Exactly that one condition: a second one can only narrow, and one that
+    // narrows to nothing fences nothing.
+    if (conditions === undefined || names.length !== 1 || names[0] !== expected) {
+        throw new KubernetesAdmissionFenceInertError('ValidatingAdmissionPolicy', policyName, 'spec.matchConditions', `exactly one condition, ${expected}`, describe(names.length === 0 ? undefined : names));
+    }
+}
+function assertFailClosed(policyName, policy) {
+    if (policy.failurePolicy !== 'Fail') {
+        throw new KubernetesAdmissionFenceInertError('ValidatingAdmissionPolicy', policyName, 'spec.failurePolicy', '"Fail" (an expression that errors must refuse the write, not admit it)', describe(policy.failurePolicy));
+    }
+}
+function specOf(kind, objectName, object) {
+    const spec = isRecord(object) ? object.spec : undefined;
+    if (!isRecord(spec)) {
+        throw new KubernetesAdmissionFenceInertError(kind, objectName, 'spec', 'an object', describe(spec));
+    }
+    return spec;
+}
+function assertBindingAttaches(bindingName, spec, policyName) {
+    if (spec.policyName !== policyName) {
+        throw new KubernetesAdmissionFenceInertError('ValidatingAdmissionPolicyBinding', bindingName, 'spec.policyName', JSON.stringify(policyName), describe(spec.policyName));
+    }
+    const actions = listOf(spec.validationActions);
+    if (actions === undefined || !actions.includes('Deny')) {
+        throw new KubernetesAdmissionFenceInertError('ValidatingAdmissionPolicyBinding', bindingName, 'spec.validationActions', 'a list including "Deny" (Audit and Warn log and admit)', describe(spec.validationActions));
+    }
+}
+/**
+ * The main fence: attached, denying, fail-closed, covering the namespace and
+ * every verb the host issues, and — when configured — matching the host.
+ */
+export function assertFenceEnforces(fence, namespace, perSandbox) {
+    assertPolicyAndBinding(fence, namespace, FENCE_OPERATIONS, perSandbox.hostIdentity);
+}
+function assertPolicyAndBinding(fence, namespace, operations, hostIdentity) {
+    const policy = specOf('ValidatingAdmissionPolicy', fence.policyName, fence.policy);
+    assertFailClosed(fence.policyName, policy);
+    assertMatchResources('ValidatingAdmissionPolicy', fence.policyName, 'spec.matchConstraints', policy.matchConstraints, operations, undefined, true);
+    const validations = listOf(policy.validations);
+    if (validations === undefined || validations.length === 0) {
+        throw new KubernetesAdmissionFenceInertError('ValidatingAdmissionPolicy', fence.policyName, 'spec.validations', 'at least one validation (a policy with none validates nothing)', describe(policy.validations));
+    }
+    assertHostIdentity(fence.policyName, policy, hostIdentity);
+    const binding = specOf('ValidatingAdmissionPolicyBinding', fence.bindingName, fence.binding);
+    assertBindingAttaches(fence.bindingName, binding, fence.policyName);
+    assertMatchResources('ValidatingAdmissionPolicyBinding', fence.bindingName, 'spec.matchResources', binding.matchResources, operations, namespace, false);
+    return { policy, binding };
+}
+// ---------------------------------------------------------------------------
+// The companion: the operator-pinned host set
+// ---------------------------------------------------------------------------
+/** The companion policy's name: the main policy's, with this appended. */
+export const PERMITTED_HOSTS_POLICY_SUFFIX = '-hosts';
+/**
+ * The companion's names, derived rather than configured: one more name to
+ * keep in step with an applied object is one more way for the check to read
+ * the wrong object.
+ */
+export function permittedHostsFenceNames(perSandbox) {
+    const policyName = `${perSandbox.admissionPolicyName}${PERMITTED_HOSTS_POLICY_SUFFIX}`;
+    return { policyName, bindingName: `${policyName}-binding` };
+}
+/** The companion's `spec.paramKind`. */
+export const PERMITTED_HOSTS_PARAM_KIND = { apiVersion: 'v1', kind: 'ConfigMap' };
+/**
+ * The companion's variables and validation, VERBATIM. Owned here, compared
+ * against the cluster's copy by {@link assertPermittedHostsFenceEnforces} and
+ * against the shipped YAML by a test, so the three cannot drift: an applied
+ * companion with an edited expression is a fence this backend cannot vouch
+ * for, and is refused as one.
+ *
+ * Read as: every egress rule that carries `toFQDNs` must carry `toPorts`, every
+ * port of which is in `data.ports`; and every `toFQDNs` entry is a `matchName`
+ * in `data.hosts` or a `matchPattern` in `data.patterns`. Lists are
+ * newline-separated strings because a ConfigMap holds strings; a key that is
+ * missing makes the expression error, and `failurePolicy: Fail` makes an
+ * error a refusal.
+ */
+export const PERMITTED_HOSTS_VARIABLES = [
+    {
+        name: 'egress',
+        expression: 'has(object.spec) && has(object.spec.egress) ? object.spec.egress : []',
+    },
+    { name: 'names', expression: "params.data.hosts.split('\\n')" },
+    { name: 'patterns', expression: "params.data.patterns.split('\\n')" },
+    { name: 'ports', expression: "params.data.ports.split('\\n')" },
+];
+export const PERMITTED_HOSTS_VALIDATIONS = [
+    {
+        expression: 'variables.egress.all(r, !has(r.toFQDNs) || (has(r.toPorts) && size(r.toPorts) > 0 && ' +
+            'r.toPorts.all(p, has(p.ports) && size(p.ports) > 0 && ' +
+            'p.ports.all(q, q.port in variables.ports)) && ' +
+            'r.toFQDNs.all(f, (has(f.matchName) && f.matchName in variables.names) || ' +
+            '(has(f.matchPattern) && f.matchPattern in variables.patterns))))',
+    },
+];
+/**
+ * The companion policy and its binding, compared to what this version ships.
+ * Everything {@link assertFenceEnforces} proves for the main fence, over
+ * CREATE and UPDATE, plus: the parameter kind, the variables and validation
+ * verbatim, and a binding whose `paramRef` is THIS ConfigMap, by name, and
+ * denies when it is missing — a binding with no parameter, or one that lets a
+ * missing parameter through, pins nothing.
+ */
+export function assertPermittedHostsFenceEnforces(fence, namespace, perSandbox, param) {
+    const { policy, binding } = assertPolicyAndBinding(fence, namespace, COMPANION_OPERATIONS, perSandbox.hostIdentity);
+    const policyFail = (field, expected, actual) => {
+        throw new KubernetesAdmissionFenceInertError('ValidatingAdmissionPolicy', fence.policyName, field, expected, describe(actual));
+    };
+    if (!isDeepStrictEqual(policy.paramKind, PERMITTED_HOSTS_PARAM_KIND)) {
+        policyFail('spec.paramKind', describe(PERMITTED_HOSTS_PARAM_KIND), policy.paramKind);
+    }
+    const variables = (listOf(policy.variables) ?? []).map((v) => isRecord(v) ? { name: v.name, expression: normalizeExpression(v.expression) } : v);
+    const expectedVariables = PERMITTED_HOSTS_VARIABLES.map((v) => ({
+        name: v.name,
+        expression: normalizeExpression(v.expression),
+    }));
+    if (!isDeepStrictEqual(variables, expectedVariables)) {
+        policyFail('spec.variables', describe(expectedVariables), variables);
+    }
+    const validations = (listOf(policy.validations) ?? []).map((v) => isRecord(v) ? { expression: normalizeExpression(v.expression) } : v);
+    const expectedValidations = PERMITTED_HOSTS_VALIDATIONS.map((v) => ({
+        expression: normalizeExpression(v.expression),
+    }));
+    if (!isDeepStrictEqual(validations, expectedValidations)) {
+        policyFail('spec.validations', describe(expectedValidations), validations);
+    }
+    const bindingFail = (field, expected, actual) => {
+        throw new KubernetesAdmissionFenceInertError('ValidatingAdmissionPolicyBinding', fence.bindingName, field, expected, describe(actual));
+    };
+    const paramRef = binding.paramRef;
+    if (!isRecord(paramRef)) {
+        bindingFail('spec.paramRef', `a reference to ConfigMap ${param.namespace}/${param.name} (a binding with no parameter pins no hosts)`, paramRef);
+        return;
+    }
+    if (paramRef.name !== param.name) {
+        bindingFail('spec.paramRef.name', JSON.stringify(param.name), paramRef.name);
+    }
+    if (paramRef.namespace !== param.namespace) {
+        bindingFail('spec.paramRef.namespace', JSON.stringify(param.namespace), paramRef.namespace);
+    }
+    if (paramRef.selector !== undefined) {
+        bindingFail('spec.paramRef.selector', 'absent (the parameter is named, not selected)', paramRef.selector);
+    }
+    if (paramRef.parameterNotFoundAction !== 'Deny') {
+        bindingFail('spec.paramRef.parameterNotFoundAction', '"Deny" (an allow here admits every grant while the ConfigMap is missing)', paramRef.parameterNotFoundAction);
+    }
+}
+/**
+ * Split one key into its entries. The admission policy splits the same string
+ * on `\n` and compares entries byte for byte, so an entry with a stray space
+ * or a `\r` would be accepted here and never match there; it is refused as
+ * malformed instead. Empty lines are dropped, which is what lets a value end
+ * in a newline.
+ */
+function entriesOf(param, data, key) {
+    const value = data[key];
+    if (typeof value !== 'string') {
+        throw new KubernetesPermittedHostsParamError(param, `has no data.${key} string (found ${describe(value)}); the policy's expression reads it, so a missing key denies every grant`);
+    }
+    const entries = value.split('\n').filter((line) => line !== '');
+    for (const entry of entries) {
+        if (entry.trim() !== entry) {
+            throw new KubernetesPermittedHostsParamError(param, `has a data.${key} entry with surrounding whitespace or a carriage return (${JSON.stringify(entry)}); the policy compares entries byte for byte, so it would never match`);
+        }
+    }
+    return entries;
+}
+/**
+ * Parse the ConfigMap's `data`, with the same grammar the writer's hosts go
+ * through ({@link assertUsableHost}), so a parameter cannot permit a name the
+ * writer would refuse to emit.
+ */
+export function parsePermittedHosts(param, configMap) {
+    const data = isRecord(configMap) ? configMap.data : undefined;
+    if (!isRecord(data)) {
+        throw new KubernetesPermittedHostsParamError(param, 'has no data');
+    }
+    const bad = (what, entry, why) => {
+        throw new KubernetesPermittedHostsParamError(param, `lists ${what} ${JSON.stringify(entry)}, which ${why}`);
+    };
+    const hosts = new Set();
+    for (const entry of entriesOf(param, data, 'hosts')) {
+        if (entry.startsWith('.')) {
+            bad('host', entry, 'is a domain entry; data.hosts holds exact names, and a domain is its name here plus a *.domain line in data.patterns');
+        }
+        try {
+            assertUsableHost(entry);
+        }
+        catch (err) {
+            bad('host', entry, `is not a usable hostname (${err instanceof Error ? err.message : String(err)})`);
+        }
+        if (entry !== entry.toLowerCase())
+            bad('host', entry, 'is not lowercase; Cilium compares the lowercase name a lookup returned');
+        hosts.add(entry);
+    }
+    const patterns = new Set();
+    for (const entry of entriesOf(param, data, 'patterns')) {
+        if (!entry.startsWith('*.'))
+            bad('pattern', entry, 'is not of the form *.<domain>');
+        const domain = entry.slice(2);
+        try {
+            assertUsableHost(`.${domain}`);
+        }
+        catch (err) {
+            bad('pattern', entry, `is not a usable domain pattern (${err instanceof Error ? err.message : String(err)})`);
+        }
+        if (domain !== domain.toLowerCase())
+            bad('pattern', entry, 'is not lowercase');
+        patterns.add(entry);
+    }
+    const ports = new Set();
+    for (const entry of entriesOf(param, data, 'ports')) {
+        const port = Number(entry);
+        if (!/^[1-9][0-9]{0,4}$/.test(entry) || port > 65535) {
+            bad('port', entry, 'is not a port number (1 to 65535, written without a sign or leading zero)');
+        }
+        ports.add(port);
+    }
+    return { hosts, patterns, ports };
+}
+/** GET and parse the parameter. A missing or unreadable ConfigMap refuses. */
+export async function readPermittedHosts(client, param, signal) {
+    let configMap;
+    try {
+        configMap = await client.request('GET', configMapPath(param.namespace, param.name), undefined, signal);
+    }
+    catch (err) {
+        if (err instanceof KubernetesAlreadyGoneError) {
+            throw new KubernetesPermittedHostsParamError(param, 'does not exist, so the admission policy bound to it denies every grant');
+        }
+        if (err instanceof KubernetesCredentialError) {
+            throw new KubernetesPermittedHostsParamError(param, 'cannot be read by this host (grant it get on that one ConfigMap; the companion manifest includes the Role)', err);
+        }
+        throw err;
+    }
+    return parsePermittedHosts(param, configMap);
+}
+/**
+ * Refuse, locally, any host or port outside the permitted set. `hosts` are the
+ * canonical `allowedHosts` entries and `portsFor` the port list the writer's
+ * narrowing will emit for an entry (`undefined`: no restriction).
+ *
+ * A `.domain` entry becomes a `matchName` plus a `matchPattern`, and the
+ * admission rule checks each against its own list, so both must be present.
+ */
+export function assertWithinPermittedHosts(param, permitted, hosts, portsFor) {
+    const outside = [];
+    const outsidePorts = new Set();
+    const unrestricted = [];
+    for (const host of hosts) {
+        const exact = host.startsWith('.') ? host.slice(1) : host;
+        const allowed = permitted.hosts.has(exact) && (!host.startsWith('.') || permitted.patterns.has(`*.${exact}`));
+        if (!allowed)
+            outside.push(host);
+        const ports = portsFor(host);
+        if (ports === undefined) {
+            unrestricted.push(host);
+            continue;
+        }
+        for (const port of ports)
+            if (!permitted.ports.has(port))
+                outsidePorts.add(port);
+    }
+    if (outside.length > 0 || outsidePorts.size > 0 || unrestricted.length > 0) {
+        throw new KubernetesPermittedHostsError(param, outside, [...outsidePorts], unrestricted);
+    }
+}
+//# sourceMappingURL=per-sandbox-fence.js.map

package/dist/backends/kubernetes/per-sandbox-fence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"per-sandbox-fence.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/per-sandbox-fence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,OAAO,EAGN,gBAAgB,GAChB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAC9E,OAAO,EACN,0BAA0B,EAE1B,yBAAyB,GACzB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAS5C;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAIlD;IACA;IACA;IACA;IACA;IAPQ,IAAI,GAAG,oCAAoC,CAAA;IAE7D,YACU,YAA6B,EAC7B,UAAkB,EAClB,KAAa,EACb,QAAgB,EAChB,MAAc;QAEvB,KAAK,CACJ,8DAA8D,YAAY,UAAU,UAAU,2CAA2C,KAAK,OAAO,MAAM,cAAc,QAAQ,uXAAuX,CACxiB,CAAA;QARQ,iBAAY,GAAZ,YAAY,CAAiB;QAC7B,eAAU,GAAV,UAAU,CAAQ;QAClB,UAAK,GAAL,KAAK,CAAQ;QACb,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;IAKxB,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAIlD;IAHQ,IAAI,GAAG,oCAAoC,CAAA;IAE7D,YACU,KAAoC,EAC7C,MAAc,EACd,KAAe;QAEf,KAAK,CACJ,4EAA4E,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,WAAW,MAAM,yYAAyY,EACngB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAC3C,CAAA;QAPQ,UAAK,GAAL,KAAK,CAA+B;IAQ9C,CAAC;CACD;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAI7C;IACA;IACA;IACA;IANQ,IAAI,GAAG,+BAA+B,CAAA;IAExD,YACU,KAAoC,EACpC,KAAwB,EACxB,KAAwB,EACxB,oBAAuC;QAEhD,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC1F,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC5D,CAAC;QACD,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CACT,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mLAAmL,CACnP,CAAA;QACF,CAAC;QACD,KAAK,CACJ,oDAAoD,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,sDAAsD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,iHAAiH,CACxQ,CAAA;QAnBQ,UAAK,GAAL,KAAK,CAA+B;QACpC,UAAK,GAAL,KAAK,CAAmB;QACxB,UAAK,GAAL,KAAK,CAAmB;QACxB,yBAAoB,GAApB,oBAAoB,CAAmB;IAiBjD,CAAC;CACD;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,SAAS,QAAQ,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAA;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAClC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AAChG,CAAC;AAED,iGAAiG;AACjG,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED,MAAM,YAAY,GAAG,WAAW,CAAA;AAChC,MAAM,cAAc,GAAG,IAAI,CAAA;AAC3B,MAAM,eAAe,GAAG,uBAAuB,CAAA;AAE/C,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAA;AACvE,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAA;AAIjE,SAAS,MAAM,CAAC,KAAc;IAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC5B,OAAO,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;AACxD,CAAC;AAED,oFAAoF;AACpF,SAAS,UAAU,CAAC,IAAa,EAAE,SAAoB;IACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACjC,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,MAAc,EAAW,EAAE;QACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QAChC,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3E,CAAC,CAAA;IACD,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACzD,OAAO,CACN,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC;QAC9B,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC;QAClC,GAAG,CAAC,WAAW,EAAE,eAAe,CAAC;QACjC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAC5B,CAAA;AACF,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,KAAc,EAAE,SAAoB;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC5B,IAAqB,EACrB,UAAkB,EAClB,IAAqD,EACrD,KAAc,EACd,UAAgC,EAChC,SAA6B;AAC7B,sFAAsF;AACtF,aAAsB;IAEtB,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAe,EAAS,EAAE;QACxE,MAAM,IAAI,kCAAkC,CAC3C,IAAI,EACJ,UAAU,EACV,GAAG,IAAI,IAAI,KAAK,EAAE,EAClB,QAAQ,EACR,QAAQ,CAAC,MAAM,CAAC,CAChB,CAAA;IACF,CAAC,CAAA;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3C,IAAI,aAAa;YAChB,IAAI,CAAC,eAAe,EAAE,gDAAgD,EAAE,KAAK,CAAC,CAAA;QAC/E,OAAM;IACP,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,kCAAkC,CAC3C,IAAI,EACJ,UAAU,EACV,IAAI,EACJ,WAAW,EACX,QAAQ,CAAC,KAAK,CAAC,CACf,CAAA;IACF,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,EAAE,CAAC;QACxD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;YAC1D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACtB,IAAI,CACH,eAAe,EACf,mBAAmB,SAAS,iBAAiB,cAAc,IAAI,eAAe,mFAAmF,EACjK,KAAK,CAAC,aAAa,CACnB,CAAA;YACF,CAAC;QACF,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,oBAAoB,CAAA;IAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACpC,IAAI,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC/C,IAAI,CACH,sBAAsB,EACtB,qBAAqB,SAAS,OAAO,eAAe,EAAE,EACtD,QAAQ,CACR,CAAA;YACF,CAAC;QACF,CAAC;IACF,CAAC;IACD,uEAAuE;IACvE,wEAAwE;IACxE,sDAAsD;IACtD,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;IAC3C,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,KAAK,GACV,QAAQ,CAAC,cAAc,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;gBACzF,CAAC;YACF,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;QACjE,IAAI,CAAC,KAAK;YACT,IAAI,CACH,gBAAgB,EAChB,wDAAwD,EACxD,cAAc,CACd,CAAA;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAA;IACjD,IAAI,SAAS,KAAK,SAAS,IAAI,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC9F,wEAAwE;QACxE,iEAAiE;QACjE,uDAAuD;QACvD,MAAM,OAAO,GAAG,oBAAoB,CAAC,iBAAiB,EAAE;YACvD,6BAA6B,EAAE,SAAS;SACxC,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,CACH,mBAAmB,EACnB,qCAAqC,SAAS,0JAA0J,EACxM,iBAAiB,CACjB,CAAA;QACF,CAAC;IACF,CAAC;AACF,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAC1B,UAAkB,EAClB,MAA+B,EAC/B,YAAgC;IAEhC,IAAI,YAAY,KAAK,SAAS;QAAE,OAAM;IACtC,MAAM,QAAQ,GAAG,iCAAiC,YAAY,GAAG,CAAA;IACjE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IACjD,MAAM,KAAK,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1C,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CACpD,CAAA;IACD,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7E,MAAM,IAAI,kCAAkC,CAC3C,2BAA2B,EAC3B,UAAU,EACV,sBAAsB,EACtB,0BAA0B,QAAQ,EAAE,EACpC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAChD,CAAA;IACF,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB,EAAE,MAA+B;IAC5E,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,kCAAkC,CAC3C,2BAA2B,EAC3B,UAAU,EACV,oBAAoB,EACpB,wEAAwE,EACxE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAC9B,CAAA;IACF,CAAC;AACF,CAAC;AAED,SAAS,MAAM,CACd,IAAqB,EACrB,UAAkB,EAClB,MAAe;IAEf,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACvD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,kCAAkC,CAC3C,IAAI,EACJ,UAAU,EACV,MAAM,EACN,WAAW,EACX,QAAQ,CAAC,IAAI,CAAC,CACd,CAAA;IACF,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,SAAS,qBAAqB,CAC7B,WAAmB,EACnB,IAA6B,EAC7B,UAAkB;IAElB,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,kCAAkC,CAC3C,kCAAkC,EAClC,WAAW,EACX,iBAAiB,EACjB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAC1B,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CACzB,CAAA;IACF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,kCAAkC,CAC3C,kCAAkC,EAClC,WAAW,EACX,wBAAwB,EACxB,wDAAwD,EACxD,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAChC,CAAA;IACF,CAAC;AACF,CAAC;AAcD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAAmB,EACnB,SAAiB,EACjB,UAAkE;IAElE,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,CAAC,YAAY,CAAC,CAAA;AACpF,CAAC;AAED,SAAS,sBAAsB,CAC9B,KAAmB,EACnB,SAAiB,EACjB,UAAgC,EAChC,YAAgC;IAEhC,MAAM,MAAM,GAAG,MAAM,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAClF,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC1C,oBAAoB,CACnB,2BAA2B,EAC3B,KAAK,CAAC,UAAU,EAChB,uBAAuB,EACvB,MAAM,CAAC,gBAAgB,EACvB,UAAU,EACV,SAAS,EACT,IAAI,CACJ,CAAA;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC9C,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,kCAAkC,CAC3C,2BAA2B,EAC3B,KAAK,CAAC,UAAU,EAChB,kBAAkB,EAClB,gEAAgE,EAChE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAC5B,CAAA;IACF,CAAC;IACD,kBAAkB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;IAE1D,MAAM,OAAO,GAAG,MAAM,CAAC,kCAAkC,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5F,qBAAqB,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACnE,oBAAoB,CACnB,kCAAkC,EAClC,KAAK,CAAC,WAAW,EACjB,qBAAqB,EACrB,OAAO,CAAC,cAAc,EACtB,UAAU,EACV,SAAS,EACT,KAAK,CACL,CAAA;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAC3B,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,QAAQ,CAAA;AAErD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAA4C;IAIpF,MAAM,UAAU,GAAG,GAAG,UAAU,CAAC,mBAAmB,GAAG,6BAA6B,EAAE,CAAA;IACtF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,UAAU,UAAU,EAAE,CAAA;AAC5D,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAW,CAAA;AAE1F;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAGhC;IACL;QACC,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,uEAAuE;KACnF;IACD,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gCAAgC,EAAE;IAC/D,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,mCAAmC,EAAE;IACrE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gCAAgC,EAAE;CAC/D,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAA+C;IACtF;QACC,UAAU,EACT,uFAAuF;YACvF,wDAAwD;YACxD,gDAAgD;YAChD,2EAA2E;YAC3E,kEAAkE;KACnE;CACD,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iCAAiC,CAChD,KAAmB,EACnB,SAAiB,EACjB,UAAkE,EAClE,KAAoC;IAEpC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,sBAAsB,CACjD,KAAK,EACL,SAAS,EACT,oBAAoB,EACpB,UAAU,CAAC,YAAY,CACvB,CAAA;IACD,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAe,EAAS,EAAE;QAC9E,MAAM,IAAI,kCAAkC,CAC3C,2BAA2B,EAC3B,KAAK,CAAC,UAAU,EAChB,KAAK,EACL,QAAQ,EACR,QAAQ,CAAC,MAAM,CAAC,CAChB,CAAA;IACF,CAAC,CAAA;IACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,0BAA0B,CAAC,EAAE,CAAC;QACtE,UAAU,CAAC,gBAAgB,EAAE,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IACrF,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5D,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CACjF,CAAA;IACD,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC;KAC7C,CAAC,CAAC,CAAA;IACH,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACtD,UAAU,CAAC,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAChE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CACnE,CAAA;IACD,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC;KAC7C,CAAC,CAAC,CAAA;IACH,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC1D,UAAU,CAAC,kBAAkB,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,WAAW,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAe,EAAS,EAAE;QAC/E,MAAM,IAAI,kCAAkC,CAC3C,kCAAkC,EAClC,KAAK,CAAC,WAAW,EACjB,KAAK,EACL,QAAQ,EACR,QAAQ,CAAC,MAAM,CAAC,CAChB,CAAA;IACF,CAAC,CAAA;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IACjC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,WAAW,CACV,eAAe,EACf,4BAA4B,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,8CAA8C,EACvG,QAAQ,CACR,CAAA;QACD,OAAM;IACP,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAClC,WAAW,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAC5C,WAAW,CAAC,yBAAyB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrC,WAAW,CACV,wBAAwB,EACxB,+CAA+C,EAC/C,QAAQ,CAAC,QAAQ,CACjB,CAAA;IACF,CAAC;IACD,IAAI,QAAQ,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QACjD,WAAW,CACV,uCAAuC,EACvC,0EAA0E,EAC1E,QAAQ,CAAC,uBAAuB,CAChC,CAAA;IACF,CAAC;AACF,CAAC;AAaD;;;;;;GAMG;AACH,SAAS,SAAS,CACjB,KAAoC,EACpC,IAA6B,EAC7B,GAAmC;IAEnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;IACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,kCAAkC,CAC3C,KAAK,EACL,eAAe,GAAG,kBAAkB,QAAQ,CAAC,KAAK,CAAC,0EAA0E,CAC7H,CAAA;IACF,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAA;IAC/D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,kCAAkC,CAC3C,KAAK,EACL,cAAc,GAAG,4DAA4D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,uEAAuE,CACzK,CAAA;QACF,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAAoC,EACpC,SAAkB;IAElB,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,kCAAkC,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW,EAAS,EAAE;QAC/D,MAAM,IAAI,kCAAkC,CAC3C,KAAK,EACL,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,GAAG,EAAE,CACtD,CAAA;IACF,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,CACF,MAAM,EACN,KAAK,EACL,sHAAsH,CACtH,CAAA;QACF,CAAC;QACD,IAAI,CAAC;YACJ,gBAAgB,CAAC,KAAK,CAAC,CAAA;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CACF,MAAM,EACN,KAAK,EACL,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAChF,CAAA;QACF,CAAC;QACD,IAAI,KAAK,KAAK,KAAK,CAAC,WAAW,EAAE;YAChC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,wEAAwE,CAAC,CAAA;QAC7F,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,+BAA+B,CAAC,CAAA;QACnF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC;YACJ,gBAAgB,CAAC,IAAI,MAAM,EAAE,CAAC,CAAA;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CACF,SAAS,EACT,KAAK,EACL,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CACtF,CAAA;QACF,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,CAAC,WAAW,EAAE;YAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAA;QAC9E,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;YACtD,GAAG,CACF,MAAM,EACN,KAAK,EACL,2EAA2E,CAC3E,CAAA;QACF,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AAClC,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,MAAwB,EACxB,KAAoC,EACpC,MAAoB;IAEpB,IAAI,SAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,KAAK,EACL,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,EAC1C,SAAS,EACT,MAAM,CACN,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,0BAA0B,EAAE,CAAC;YAC/C,MAAM,IAAI,kCAAkC,CAC3C,KAAK,EACL,wEAAwE,CACxE,CAAA;QACF,CAAC;QACD,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;YAC9C,MAAM,IAAI,kCAAkC,CAC3C,KAAK,EACL,4GAA4G,EAC5G,GAAG,CACH,CAAA;QACF,CAAC;QACD,MAAM,GAAG,CAAA;IACV,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACzC,KAAoC,EACpC,SAAyB,EACzB,KAAwB,EACxB,QAAyD;IAEzD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IACtC,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACzD,MAAM,OAAO,GACZ,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAA;QAC9F,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACvB,SAAQ;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,6BAA6B,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,YAAY,CAAC,CAAA;IACzF,CAAC;AACF,CAAC"}

package/dist/backends/kubernetes/per-sandbox-policy.d.ts

@@ -46,7 +46,11 @@
  * operator's own baseline policy. So before the FIRST write, this module
  * proves an operator applied a `ValidatingAdmissionPolicy` and its binding,
  * and refuses with {@link KubernetesAdmissionFenceMissingError}, having
- * written nothing, if either is absent. The shipped example
+ * written nothing, if either is absent — and with
+ * {@link KubernetesAdmissionFenceInertError}, naming the field, if either
+ * exists and would not enforce (see `per-sandbox-fence.ts`: the same
+ * standard the `no-network` baseline's named-object check holds its own
+ * object to). The shipped example
  * (`k8s/manifests/validatingadmissionpolicy-cilium.yaml`) bounds the host
  * identity to this name prefix, an owner reference whose uid the name has to
  * match, ONE selector label whose VALUE is that owner's own name (the shape
@@ -56,6 +60,18 @@
  * kube-dns rule on port 53, no address-based or entity-based peers and no
  * ingress.
  *
+ * ## Verified after every write
+ *
+ * Reading the object back proves the object is the one that was sent. It says
+ * nothing about the BOUNDARY, which is the union of every policy selecting the
+ * pod: a policy applied between this sandbox's create and its grant that
+ * allows more is invisible to a read-back of this one. So after the read-back
+ * the union is enumerated again, against the baseline translation plus the
+ * policy just written (`unionEgressAllowance`), and if anything allows more
+ * the object is deleted before the error is thrown — the per-sandbox
+ * analogue of the baseline's "no sandbox is handed back". An empty list is not
+ * re-checked: a deletion only narrows.
+ *
  * ## Union, not replacement
  *
  * The cluster unions every policy selecting a pod, so what this writes ADDS
@@ -78,9 +94,10 @@
  * network, and it needs a cluster that enforces plus a positive control.
  */
 import type { SandboxNetworkPolicy } from '@namzu/sdk';
-import { type KubernetesEgressConfig, KubernetesNetworkPolicyHostError, type KubernetesPerSandboxEgressConfig } from './egress-policy.js';
+import { type KubernetesEgressConfig, KubernetesNetworkPolicyHostError, type KubernetesPerSandboxEgressConfig, type KubernetesTranslatedEgressPolicy } from './egress-policy.js';
 import { type KubernetesClient } from './k8s-client.js';
 import { type KubernetesOwnerReference } from './objects.js';
+import { KubernetesAdmissionFenceInertError, KubernetesPermittedHostsError, KubernetesPermittedHostsParamError } from './per-sandbox-fence.js';
 /**
  * Every per-sandbox policy's name starts with this, and the shipped admission
  * policy refuses one that does not.
@@ -162,6 +179,7 @@ export declare class KubernetesAdmissionFenceMissingError extends Error {
  * package index — keeps resolving.
  */
 export { KubernetesNetworkPolicyHostError };
+export { KubernetesAdmissionFenceInertError, KubernetesPermittedHostsError, KubernetesPermittedHostsParamError, };
 /**
  * Raised when the object an acquire created reported no `metadata.uid`.
  *
@@ -187,7 +205,7 @@ export declare class KubernetesOwnerUidMissingError extends Error {
 export interface PerSandboxPolicyFence {
     assertApplied(signal?: AbortSignal): Promise<void>;
 }
-export declare function buildAdmissionFence(client: KubernetesClient, perSandbox: KubernetesPerSandboxEgressConfig): PerSandboxPolicyFence;
+export declare function buildAdmissionFence(client: KubernetesClient, perSandbox: KubernetesPerSandboxEgressConfig, namespace: string): PerSandboxPolicyFence;
 /** What one sandbox's policy writer needs to know. */
 export interface PerSandboxPolicySetterOptions {
     readonly client: KubernetesClient;
@@ -205,6 +223,30 @@ export interface PerSandboxPolicySetterOptions {
      * config, through the one resolver.
      */
     readonly selectorValue: string;
+    /**
+     * The post-write union check: given the policy just written and read back,
+     * prove that the union of every policy selecting the pod is still the
+     * baseline plus that policy, and throw if any other one allows more.
+     * Absent when the deployment opted out of union verification
+     * (`egress.verify: 'named-object-only'`), exactly as the create path's
+     * union check is.
+     */
+    readonly verifyUnion?: (written: KubernetesTranslatedEgressPolicy, signal?: AbortSignal) => Promise<void>;
+}
+/**
+ * Raised when a per-sandbox policy was written, FAILED a post-write check, and
+ * the attempt to remove it failed too. The refusal that triggered the removal
+ * is `cause`; the policy may still be in force, and the message says so,
+ * because the one thing a caller must not conclude is that the refusal left the
+ * cluster as it found it.
+ */
+export declare class KubernetesPerSandboxPolicyNotRemovedError extends Error {
+    readonly policyName: string;
+    readonly path: string;
+    readonly refusal: unknown;
+    readonly removal: unknown;
+    readonly name = "KubernetesPerSandboxPolicyNotRemovedError";
+    constructor(policyName: string, path: string, refusal: unknown, removal: unknown);
 }
 /**
  * Build the `setNetworkPolicy` this backend attaches to a sandbox handle.